GCVE-110-OSM-2026-12410

Package @siriusbeyond/utils@99.0.0 declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects host reconnaissance (hostname, username, platform, cwd, home directory, UID, CI/cloud fingerprints) and enumerates process.env keys matching credential regexes (/token/i, /secret/i, /key/i, /password/i, /auth/i, /aws/i, /azure/i, /npm/i, /git/i, /docker/i, /registry/i, /artifactory/i, /nexus/i, /credential/i), taking up to 20 matches, and POSTs the collected payload via https.request to api.telegram.org /bot<token>/sendMessage using a hardcoded Telegram bot token (8605555117) and chat id (1064260758). The version number 99.0.0 and the exfiltration behavior are consistent with a dependency-confusion attack against an internal @siriusbeyond scope. The activity fires automatically on default npm install with no user action. ENTRY callback.js (install-hook: node callback.js 2>/dev/null || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 2 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES callback.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Hsbcsirusconfusion_bot (id 8605555117)